100+ Free ITIL 4 InfoSec Practice Questions
Pass your ITIL 4 Practitioner: Information Security Management exam on the first try — instant access, no signup required.
What is the BEST definition of Privileged Access Management (PAM)?
Explore More ITIL Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
More From This Family
Videos and articles for deeper review.
Key Facts: ITIL 4 InfoSec Exam
28/40
Passing Score
70% (PeopleCert)
60 min
Exam Duration
PeopleCert (75 min for non-native English)
40 Qs
Multiple Choice
Closed-book OTQ format
Foundation
Prerequisite
ITIL 4 Foundation required
$310
Exam Fee
PeopleCert region-dependent USD
3 Years
Cert Validity
Renewal via CPD or re-exam
The ITIL 4 InfoSec exam has 40 multiple-choice questions in 60 minutes (75 minutes for non-native English speakers), closed-book, with a 70% pass mark (28/40). It covers the CIA triad and supporting security objectives; ISO/IEC 27001:2022 ISMS, NIST CSF 2.0, CIS Controls v8; policy/standard/procedure hierarchy; risk-based approach (identify, assess, treat, accept residual, monitor); data classification and DLP; encryption (AES-256, TLS 1.3, HSM, BYOK); IAM (MFA, FIDO2, SSO, RBAC, ABAC, PAM/JIT); Zero Trust (NIST 800-207), ZTNA, SASE, micro-segmentation; security operations (SIEM, SOAR, EDR/XDR); incident response (NIST 800-61); MITRE ATT&CK, Cyber Kill Chain, STIX/TAXII; application security (OWASP Top 10, SAST/DAST/SCA, SBOM, SLSA); cloud security (shared responsibility, CSPM, CASB, Kubernetes); regulatory frameworks (GDPR, PCI DSS, NIS 2, DORA); and integration with Change Enablement, Incident Management, Service Continuity, and other ITIL practices.
Sample ITIL 4 InfoSec Practice Questions
Try these sample questions to test your ITIL 4 InfoSec exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.
1What is the primary purpose of the Information Security Management practice in ITIL 4?
2Which acronym represents the three core security objectives at the heart of Information Security Management?
3Which property of information is compromised when an unauthorized user can read a confidential customer record?
4A ransomware attack encrypts the company's file server. Which CIA property is MOST directly compromised?
5Which information security property ensures that an actor cannot later deny having performed a recorded action?
6Which international standard specifies requirements for an Information Security Management System (ISMS)?
7The NIST Cybersecurity Framework 2.0 organizes outcomes into six Functions. Which set lists them correctly?
8What is the BEST description of the relationship between ITIL 4 Information Security Management and ISO/IEC 27001?
9In the security policy hierarchy, which document is the HIGHEST-LEVEL statement of management intent for information security?
10Which of the following is a GUIDELINE rather than a STANDARD in the security policy hierarchy?
About the ITIL 4 InfoSec Exam
The ITIL 4 Practitioner: Information Security Management certification validates a professional's ability to protect the information that the organization needs to conduct its business — ensuring confidentiality, integrity, and availability (the CIA triad), plus authenticity, non-repudiation, accountability, and reliability. The 60-minute closed-book exam contains 40 multiple-choice (Objective Test Question) items and requires 70% (28 of 40) to pass. ITIL 4 Foundation is a mandatory prerequisite. The exam covers ISO/IEC 27001 ISMS structure, NIST Cybersecurity Framework 2.0, CIS Controls v8, risk-based treatment, identity and access management, Zero Trust architecture, security operations and incident response, application and cloud security, and integration of the practice across the ITIL 4 Service Value System.
Questions
40 scored questions
Time Limit
60 minutes
Passing Score
70%
Exam Fee
$310 USD (PeopleCert (AXELOS))
ITIL 4 InfoSec Exam Content Outline
InfoSec Purpose, CIA Triad, and Security Objectives
Practice purpose; CIA triad plus authenticity, non-repudiation, accountability, reliability; risk-based approach; value co-creation through security
Frameworks, Standards, and Governance
ISO/IEC 27001:2022 ISMS, NIST CSF 2.0 (Govern, Identify, Protect, Detect, Respond, Recover), CIS Controls v8, three lines model, policy hierarchy
Risk Management and Information Classification
Risk identification, assessment, treatment (mitigate, transfer, avoid, accept), residual-risk acceptance, classification schemes, DLP
Identity, Access, and Zero Trust
MFA (FIDO2, passkeys, SSO via SAML/OIDC), RBAC vs ABAC, PAM, JIT/JEA, NIST 800-207 Zero Trust, micro-segmentation, ZTNA, SASE
Security Operations, Incident Response, and Threat Intel
SIEM/SOAR/EDR/XDR, NIST 800-61 incident lifecycle, forensics (chain of custody, NIST 800-86), MITRE ATT&CK, Cyber Kill Chain, STIX/TAXII
Application, Cloud, and Supply-Chain Security
OWASP Top 10 (2021), SAST/DAST/IAST/SCA, SBOM (SPDX/CycloneDX), SLSA, Sigstore/Cosign, shared responsibility, CSPM, CASB, Kubernetes security
Integration with ITIL Practices and SVS
Integration with Change Enablement, Incident, Problem, Risk Management, Service Continuity, Configuration Management; guiding principles applied
How to Pass the ITIL 4 InfoSec Exam
What You Need to Know
- Passing score: 70%
- Exam length: 40 questions
- Time limit: 60 minutes
- Exam fee: $310 USD
Keys to Passing
- Complete 500+ practice questions
- Score 80%+ consistently before scheduling
- Focus on highest-weighted sections
- Use our AI tutor for tough concepts
ITIL 4 InfoSec Study Tips from Top Performers
Frequently Asked Questions
What is the ITIL 4 Information Security Management exam format?
The ITIL 4 InfoSec exam has 40 multiple-choice (Objective Test Question) items to be completed in 60 minutes. The pass mark is 70% — at least 28 correct answers out of 40. The exam is closed-book, with only provided materials permitted. Non-native English speakers receive 75 minutes (25% extra). The exam is delivered online through PeopleCert proctoring or at authorized test centers.
What are the prerequisites for ITIL 4 Information Security Management?
ITIL 4 Foundation certification is a mandatory prerequisite. Foundation establishes the SVS, Four Dimensions, Service Value Chain, Guiding Principles, and 34 ITIL Practices that the InfoSec practice builds on. Practical experience in information security, risk management, or IT operations is recommended but not required.
What topics does ITIL 4 InfoSec cover?
Core topics include: the practice purpose and CIA triad (plus authenticity, non-repudiation, accountability, reliability); frameworks and standards (ISO/IEC 27001:2022, NIST CSF 2.0, CIS Controls v8); risk management and treatment; data classification and DLP; cryptography (AES-256, TLS 1.3, HSM, BYOK); identity and access management (MFA/FIDO2, SSO, RBAC/ABAC, PAM/JIT); Zero Trust (NIST 800-207); security operations (SIEM, SOAR, EDR/XDR); incident response (NIST 800-61); MITRE ATT&CK and Cyber Kill Chain; application security (OWASP Top 10, DevSecOps); cloud and Kubernetes security; supply-chain security (SBOM, SLSA); regulatory frameworks (GDPR, PCI DSS, NIS 2, DORA); and integration with ITIL Change Enablement, Incident, Risk, and Service Continuity.
How long should I study for the ITIL 4 InfoSec exam?
Most candidates need 25-35 hours of study, assuming current ITIL 4 Foundation knowledge. Recommended path: 1) Review the CIA triad and risk-based approach; 2) Master ISO/IEC 27001, NIST CSF 2.0 Functions, and CIS Controls v8; 3) Learn Zero Trust, IAM, and modern cryptography baselines; 4) Study SOC operations, NIST 800-61 incident response, and MITRE ATT&CK; 5) Take 2-3 timed mock exams scoring 80%+ before scheduling.
What is the CIA triad and why is it central to ITIL 4 InfoSec?
The CIA triad — Confidentiality, Integrity, Availability — is the foundational set of security objectives. ITIL 4 also recognises authenticity (proof of origin), non-repudiation (cannot deny actions), accountability, and reliability. Every control choice and risk decision is justified against impact to these properties; this framing is heavily tested on the exam.
How does ITIL 4 InfoSec relate to ISO/IEC 27001 and NIST CSF?
ITIL 4 InfoSec describes how the practice integrates with the Service Value System and other ITIL practices. ISO/IEC 27001:2022 provides a certifiable Information Security Management System (ISMS) with Annex A controls. NIST CSF 2.0 organizes security outcomes into six Functions (Govern, Identify, Protect, Detect, Respond, Recover). The frameworks complement each other — ITIL operationalizes service-aware security; ISO 27001 demonstrates governance maturity; NIST CSF helps prioritize outcomes. The exam expects familiarity with all three at a conceptual level.